Here is what I keep seeing: teams have taken the vendor training courses, they use AI daily, and leadership still can't bless any of it because nobody wrote the rules. No acceptable-use policy, no answer on HIPAA, PII, or client data, no decision on which tools and plans are safe. So it all happens in the shadows, on personal accounts, with zero protection. I deliver the whole rulebook in a week: built inside a 300-person company in one of the most compliance-heavy industries there is (legal services), and for multiple nine-figure companies under one roof, working directly with their IT.
Book the free 30-minute callThe policy costs $4,500. The absence of one costs whichever of these lands first:
And the upside: the policy is the gate. Every dollar of AI savings on this site stays locked behind "legal hasn't approved it yet." This is the key, and it's the cheapest thing I sell after lunch.
What you do, what data you hold, who touches what, and what already happened in the shadows. If you have counsel or compliance, they're in this meeting.
Every data type you handle gets a lane: safe for AI, safe with a business account only, never. Client data, PHI, PII, financials, internal docs, each with a plain-English rule your people can remember.
The AUP itself: what employees may do, on which accounts, with which data, and what happens when they're unsure. Written to be read, not filed. Your counsel reviews and signs off; I engineer, they bless.
Which AI tools and which plan tiers actually protect your data: what each vendor retains, what trains on your inputs, which offer HIPAA-eligible agreements, and exactly which plans your teams should be on. The education layer: what AI actually keeps, in plain English.
A leadership briefing, the announcement your managers send, and the IT enforcement checklist (group policy settings, account provisioning, blocked tools). The rules go live instead of into a drawer.
A complete acceptable-use policy your counsel approves and your people actually read. The document every enterprise client and insurer will eventually ask you for.
A one-page decision: which AI, which tier, for which team, and why. Including what each vendor retains and which agreements cover regulated data.
The what-goes-in-what-stays-out rules on one page, written for the floor, not the file cabinet.
Group-policy and account settings so the rules are enforced by systems, not memos. Built the same way I did it with in-house IT at nine-figure companies.
No, and this isn't legal advice. I engineer the documents, the data lanes, and the tool decisions from having built this inside heavily regulated companies; your counsel reviews and signs off. That review takes them an hour instead of a month because the hard work arrives done.
The matrix covers which vendors offer HIPAA-eligible agreements and which plan tiers qualify, and the data lanes keep PHI out of everything else. Your compliance officer or counsel makes the final call; I hand them a document worth calling on.
Courses teach people how to use AI. They don't decide what your company allows, which plans protect your data, or what IT should enforce. That gap is exactly this package, and it's the gap I kept filling for companies whose teams were already trained.
Thirty minutes, free. Tell me what data you handle and what's blocking AI in your building. I'll tell you exactly what the week produces and whether $4,500 is worth it for your shop.
Book the free 30-minute call